CVE-2026-86445

The LearnPress WordPress plugin (versions 4.2.9–4.4.6 ) contains an unauthenticated information disclosure in its load_content_via_ajax administrative template handler, which fails to verify user capabilities. Attackers can retrieve the text, identifier, and type of every published quiz question,...

CVE-2026-86449

LearnPress WordPress plugin versions 4.2.7.1 through 4.4.6 fail to verify user capabilities before applying a user-supplied post status filter in one of its REST routes. This allows unauthenticated attackers to enumerate unpublished courses, including those in draft, pending, private, scheduled, ...

EUVD-2026-80199

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

CVE-2026-86444

LearnPress WordPress plugin (versions 4.2.6.4–4.4.6 ) contains a reflected XSS vulnerability via the 'skin' parameter. A user-supplied value is not escaped before being placed in an HTML attribute on a public page, allowing unauthenticated attackers to inject arbitrary JavaScript by luring a vict...

EUVD-2026-80200

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

CVE-2026-85530 GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user...

CVE-2026-85641 Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

CVE-2026-85530

GiveWP is a popular WordPress donations plugin. Versions 4.16.6 through 4.16.8.0 contain an unauthenticated account takeover vulnerability (discovered by Jakub Herman). The root cause is an inconsistent normalization of a donor's e-mail address between the stored value and the value used in subse...

CVE-2026-85641

Formidable Forms WordPress plugin versions before 6.35 are affected by an unauthenticated stored content injection vulnerability via the updated_by parameter. The plugin does not restrict who can set the identifier that records which user last edited a form entry, and it relies on that identifier...

CVE-2026-86444 LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

EUVD-2026-80196

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user...

CVE-2026-84907

Eventin (WP Event Solution) WordPress plugin versions 4.1.5 through 4.1.23 fail to properly authorise order finalisation when the offline (local) payment method is enabled. The flaw is a nonce exposed to unauthenticated visitors that is never validated against the caller's order ownership via the...

CVE-2026-84907 Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline local payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset...

EUVD-2026-80191

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

EUVD-2026-80193

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline local payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset...

CVE-2026-84829 Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-84829

CVE-2026-84829 is an unauthenticated Stored XSS in the Optimole WordPress plugin (versions 4.2.3–4.2.11 ). The root cause is improper escaping of a user-supplied srcset descriptor value before it is used to build an image tag attribute, allowing an unauthenticated attacker to inject arbitrary HTM...

EUVD-2026-80186

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and ...

CVE-2026-78472

The Ni WooCommerce Sales Report WordPress plugin (versions before 4.2.0 ) contains an unauthenticated SQL injection vulnerability caused by a failure to sanitise and escape the sort parameter before use in a SQL statement. Discovered by Erwan LR (WPScan) via Patchstack, this allows remote attacke...

CVE-2026-82125 Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam...